https

Package file treedanger

The artifact contains only package.json, leaving no implementation files, documentation, or other published material to verify how the package works. This is a substantial transparency concern.

Release historydanger

The package has only one release, published 11 years ago, with no releases in the last 12 months. This is strong evidence of abandonment risk despite the package not being deprecated.

Build provenancecaution

No build attestation, trusted publisher, or staged-publishing evidence is present. This limits publication transparency, although it is less significant than the package's age and minimal artifact.

Maintainerscaution

One registry maintainer is listed, but this administrative record does not demonstrate active maintenance or contributor capacity. The release history provides the stronger evidence here.

Package scaffoldingcaution

The published artifact has no README, tests, changelog, or release notes. Missing tests and changelogs are normal in published artifacts, but the absent README weakens consumer guidance for this library.